CVE-2026-61721 FluidSynth: Heap-based buffer overrun for DLS samples

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate or fluidsamplesanitizeloop. A crafted DLS file can place...

CVE-2026-61721

FluidSynth versions 2.5.0 through 2.5.6 contain a heap-based buffer overrun in the native DLS loader . File-controlled wsmp.loop_start and wsmp.loop_length values are assigned to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(), allowing a crafted DLS file to place ...

CVE-2026-61721 FluidSynth: Heap-based buffer overrun for DLS samples

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate or fluidsamplesanitizeloop. A crafted DLS file can place...

CVE-2026-61721 FluidSynth: Heap-based buffer overrun for DLS samples

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate or fluidsamplesanitizeloop. A crafted DLS file can place...

EUVD-2026-83375

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate or fluidsamplesanitizeloop. A crafted DLS file can place...

CVE-2026-92708

Svelte devalue is a JavaScript serialization library for use with SvelteKit, Nuxt, and other frameworks. In versions 5.1.0 through 5.9.2 , the stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view. Since a Node Buffer's backing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

PT-2026-95395

Name of the Vulnerable Software and Affected Versions Imager for Perl versions prior to 1.036 Description Reading a paletted image with pixel indexes that exceed its colour map in the i gpix p and i glin p functions leads to the disclosure of uninitialised heap memory. The TGA reader stores pixel...

CVE-2026-61721: Heap-based Buffer Overflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate or fluidsamplesanitizeloop. A crafted DLS file can place...

CVE-2026-59956: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed 16-bit iff image with a z-buffer makes iffinput::readimg allocate a temporary scanline from...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109817)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109817 advisory. FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When...

CVE-2026-54634 Hamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld sendraw command on TCP port 4532 reaches rigctlsendraw in tests/rigctlparse.c, which writes a NUL byte at bufbuflen + 1 outside its 200-byte stack buffer, and rigsendraw in...

CVE-2026-93393 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming...

FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the...

FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the...

SUSE CVE-2026-91963

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references. Original Description vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by...

CVE-2026-92947

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...